[vgulati-apphelix]

Description

Fixes the organization dropdown in Studio's "New library" form, which shows too few organizations when ORGANIZATIONS_AUTOCREATE is disabled (as on edx.org stage and prod).

Since openedx#36094, allow_to_create_new_org requires ORGANIZATIONS_AUTOCREATE. When it is off, the Authoring MFE builds the dropdown from allowed_organizations_for_libraries, which only lists organizations where the user has a staff role. As a result:

1. Global staff see only the organizations they personally hold a role in, although they may create libraries in any organization.
2. Course Admins (instructor role) never see their course's organization, although _user_can_create_library_for_org already lets them create legacy libraries there.

Changes, behind a new temporary waffle flag contentstore.expanded_library_creation_orgs (off by default):

• get_allowed_organizations_for_libraries() returns every active organization for global staff. Inactive organizations are left out because ensure_organization() rejects them when autocreate is off, matching Studio's /organizations list.
• get_organizations_for_non_course_creators() also includes organizations where the user has the instructor role, so Course Admins get the same organizations as Course Staff.

Legacy library create permissions are unchanged, since _user_can_create_library_for_org already allows these orgs. v2 library creation (LibraryRootView.post) authorizes the org with this same list. So with the flag on, a course creator who is not global staff can also create v2 libraries in orgs where they are a Course Admin. This keeps the dropdown and the v2 check in sync. With the flag off, behavior is unchanged.

Roles affected: Course Author (global staff and Course Admins in Studio).

Supporting information

• Jira: LP-1102 (private)
• Regression source: fix: allow_to_create_new_org checks org autocreate [FC-0076] openedx/openedx-platform#36094, fix: allow user provided value if can auto-create orgs [FC-0076] openedx/frontend-app-authoring#1582

Testing instructions

1. Set ORGANIZATIONS_AUTOCREATE = False and create a few organizations in Django admin, including one inactive.
2. Enable the flag at /admin/waffle/flag/ → contentstore.expanded_library_creation_orgs. Course Admins are usually not staff or superusers, so set Everyone = Yes or add them under Users.
3. As global staff, go to Studio Home → "+ New library" and open the organization dropdown.
   • Flag off: only organizations you hold a role in.
   • Flag on: every active organization; the inactive one is not listed.
4. As a non-staff Course Admin (not Course Staff) on a course in org X:
   • Flag off: X is not listed.
   • Flag on: X is listed, and "Create legacy library" in X succeeds.
5. As Course Staff, X is listed with the flag on and off (unchanged).

Unit tests (ddt cases for each role, flag on and off):

• test_library.py: get_allowed_organizations_for_libraries per role, plus test_legacy_library_org_offered_and_created, which uses stage/prod settings to check that the org is in the home API dropdown and that POST /library/ creates the legacy library.
• test_home.py: the home API returns all active organizations to global staff.

Other information

• Rollout: enable the flag in stage, verify, then prod. A new waffle flag row has Superusers checked by default, so superusers get the new behavior as soon as the row is created. The flag is temporary (target removal 2027-01-07); after that the flag-on behavior becomes the only path.
• Out of scope:
  • Creating new (v2) libraries still requires global staff or course creator status (CAN_CREATE_CONTENT_LIBRARY).
  • With ENABLE_ORGANIZATION_STAFF_ACCESS_FOR_CONTENT_LIBRARIES off, the dropdown still comes only from the user's course-creator grant (unchanged). edx.org uses the default, True.
• Test fix: HomePageLibrariesViewTest hard-coded the OrganizationFactory sequence name (name0). The new tests create organizations earlier in the module, so it now uses the created library key.
• Upstream: an equivalent openedx PR (without the temporary flag) will follow.

🤖 Generated with Claude Code

[abhalsod-sonata]

Code looks correct and CI is green. It reuses the existing role helpers (OrgInstructorRole.get_orgs_for_user next to the existing OrgStaffRole call) and keeps everything behind the flag. The inline comments are mostly about trimming the diff. One thing to fix in the description:

v2 library creation does change server-side

The description says "Server-side create permissions are unchanged; only the dropdown list changes." That holds for legacy libraries, but not for v2. LibraryRootView.post (openedx/core/djangoapps/content_libraries/rest_api/libraries.py) authorizes the org with the same helper:

if not (
    user_can_create_organizations(request.user) or
    org_name in get_allowed_organizations_for_libraries(request.user)
):
    raise ValidationError(...)

With edx.org settings (ENABLE_CREATOR_GROUP=True, ENABLE_ORGANIZATION_STAFF_ACCESS_FOR_CONTENT_LIBRARIES=True) and the flag on, take a course creator who is not global staff and who is a Course Admin (only the instructor row) on a course in org X. That user can now create a v2 library in X. With the flag off, they get 400 "User not allowed to create libraries in 'X'".

I think this is the right behavior. Admin is a superset of Staff, and the change keeps the dropdown and the v2 check in sync, so the dropdown never offers an org that v2 create then rejects. It just needs to be stated. Suggested replacement for that sentence:

Legacy library create permissions are unchanged, since _user_can_create_library_for_org already allows these orgs. v2 library creation (LibraryRootView.post) authorizes the org with this same list. So with the flag on, a course creator who is not global staff can also create v2 libraries in orgs where they are a Course Admin. This keeps the dropdown and the v2 check in sync. With the flag off, behavior is unchanged.

[vgulati-apphelix]

Code looks correct and CI is green. It reuses the existing role helpers (OrgInstructorRole.get_orgs_for_user next to the existing OrgStaffRole call) and keeps everything behind the flag. The inline comments are mostly about trimming the diff. One thing to fix in the description:

v2 library creation does change server-side

The description says "Server-side create permissions are unchanged; only the dropdown list changes." That holds for legacy libraries, but not for v2. LibraryRootView.post (openedx/core/djangoapps/content_libraries/rest_api/libraries.py) authorizes the org with the same helper:

if not (
    user_can_create_organizations(request.user) or
    org_name in get_allowed_organizations_for_libraries(request.user)
):
    raise ValidationError(...)

With edx.org settings (ENABLE_CREATOR_GROUP=True, ENABLE_ORGANIZATION_STAFF_ACCESS_FOR_CONTENT_LIBRARIES=True) and the flag on, take a course creator who is not global staff and who is a Course Admin (only the instructor row) on a course in org X. That user can now create a v2 library in X. With the flag off, they get 400 "User not allowed to create libraries in 'X'".

I think this is the right behavior. Admin is a superset of Staff, and the change keeps the dropdown and the v2 check in sync, so the dropdown never offers an org that v2 create then rejects. It just needs to be stated. Suggested replacement for that sentence:

Legacy library create permissions are unchanged, since _user_can_create_library_for_org already allows these orgs. v2 library creation (LibraryRootView.post) authorizes the org with this same list. So with the flag on, a course creator who is not global staff can also create v2 libraries in orgs where they are a Course Admin. This keeps the dropdown and the v2 check in sync. With the flag off, behavior is unchanged.

Agreed. Updated the description to call out the v2 behavior.